Working once is not working in production.
A demo answers to its author, in one process, once. Production answers to strangers, across restarts, concurrently — while no one is watching. Three questions separate the two, and the higher you climb the ladder, the more each one costs to ignore.
What is true right now?
Every node shares one truth. It must be well-shaped at the boundary and safe to write when many hands touch it.
Catches: silent state corruption on fan-in.
See the question →2 DurabilityWhat survives a restart?
State must outlive the process. A system that cannot resume, restarts — losing every in-flight decision.
Catches: the store that buckles under concurrency.
See the question →3 VisibilityWhat can you see after?
A run must be inspectable after the fact — or you cannot debug it, cost it, or trust a loop built on it.
Catches: the loop that never converges, unseen.
See the question →Answer all three and the system is dependable. Climbing the ladder — one mind, then workflows, then specialists — makes it more capable. They are different axes: capability is not dependability, and climbing is not shipping. See how they meet →
What is true right now?
Every node reads and writes one shared truth. In production that truth has to be well-shaped at the boundary — and safe to write when more than one hand touches it.
A state contract at the boundary
Illegal fields fail loudly here — not silently, three nodes later.
Merge rules for shared keys
How two writes to one key combine.
Last writer wins
Writes combine
Failures surface at the edge
An illegal write is caught where it happens. Fan-out and fan-in recombine correctly, because every shared key has a rule.
Difficulty scales with the hands on the state
Trivial when one mind loops alone. Real once steps cross boundaries. Central once specialists work concurrently over a shared truth.
What survives a restart?
State has to outlive the process that produced it. A system that cannot resume, restarts — and a restart loses every in-flight decision.
The durability spectrum — place your store on it
In-memory
Single-writer
Concurrent durable store
Single-writer store
one lockConcurrent durable store
row-level locksResume instead of restart
Durable state means a crash resumes from the last checkpoint, a human review can pause the run, and a retry is safe to repeat.
Concurrency, and replay-safe merges
Many writers over one truth; merges that must survive replay without double-counting. This is what the operational layer buys you.
What can you see after the fact?
A running system has to be inspectable after it runs. If you cannot see what happened, you cannot debug it, improve it, or answer for it.
What a span captures
Why each field earns its place.
Where traces live
One decision, made for you by policy.
The slow span is the tool, not the model
Forty percent of wall-clock is one external call — visible only because it’s traced. Cache it, parallelise it, or set a timeout.
Tokens are where the money is
Per-span token counts turn a vague bill into a line item you can attack.
A failed validation costs a full retry
The error span explains the retry segment in the cost bar. Without the trace, that spend is invisible.
The reflection loop you cannot see.
A self-correcting agent critiques its own output and tries again. Without traces underneath it, oscillation, off-topic re-runs and silent token blow-up are all invisible — the score never crosses the bar while every cycle burns another full generation of tokens. The run doesn’t crash. It just quietly costs ten times what it should.
A system is production-ready when it can answer all three — truth, durability, visibility.
Climbing the ladder is not the same as shipping it.
The ladder is the capability you build — one mind, then workflows, then specialists, then the operational layer. The three questions are the dependability you owe. They are orthogonal axes: climbing makes the system more capable; it does not make it dependable. Both, together, are production.